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AO 106 (Rev. 04/10) Application for a Search Warrant 


United States District Court FfLpQ 



for the 

Southern District of California 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 

Information that is stored at Facebook, 

1601 Willow Road, Menlo Park, California 94025 


Case No. 



CLERK US DlS'l h'lC 1 COURT 
SOUTHERN DIjJIHiCI OK CALIFORNIA 
DEPUTY 


APPLICATION FOR A SEARCH WARRA 


CASE UNSEALED PER ORDER OF COURT 

J9MJ1756 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A 

located in the Northern District of _ California _, there is now concealed (identify the 

person or describe the property to be seized)'. 


See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more)'. 
sf evidence of a crime; 

'Sf contraband, fruits of crime, or other items illegally possessed; 

□ property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

18 U.S.C. § 247(a)(2); Intentional obstruction by force of persons in the free exercise of religious belief; 

18 U.S.C. § 249(a)(1); Willfully causing bodily injury to persons through the use of a firearm because of 

18 U.S.C. § 247(a)(1) their actual or perceived religion; damage to religious property 

The application is based on these facts: 

See attached affidavit of ATF Senior Special Agent Matthew Beals 


M Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days: _) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 

CTUUa %/<svu..w-^. 

Applicant’s signature 


Sworn to before me and signed in my presence. 
Date: 

City and state: San Diego, California _ 


FBI Special Agent Maria Solomon 

Printed name and title 
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ATTACHMENT A 


This warrant applies to information associated with following Facebook 
accounts: 

Facebook ID Account Number 100027636555708, with Facebook User Name 
"John Earnest”; and 

Facebook ID Account Number 100005829157939, with Facebook | 
Username: “John Tocatina,” 

that are stored at premises owned, maintained, controlled, or operated by Facebook, 
1601 Willow Road, Menlo Park, California 94025 


i 
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ATTACHMENT B 


I. Service of Warrant 

The officer executing the warrant shall permit Facebook, as custodian of the 
computer files described in Section II below, to locate the files and copy them onto 
removable electronic storage media and deliver the same to the officer. 

II. Items Subject to Seizure 

All registration information; Phone and associated devices; Trusted devices; Deleted 
friends; Last location; IP history; Stored video and audio direct message 
communications; Any and all accounts associated by cookie; User Names and 
profile names; E-mail addresses and passwords; Any and all live stream video 
associated with account; Profile information; Friends information; Private messages 
in the user’s inbox, sent messages, trash/deleted messages, notifications and updates 
involving any and all user; Chat information in the user’s inbox, sent messages, 
trash/deleted messages, notifications and updates involving any and, all user; IP logs 
(which includes the date stamps of the IP logs at login), initial login IP address and 
account activity and other information including name, address, phone number and 
other screen names that may tend to identify the user; and any other files associated 
with the following accounts: 

Facebook ID Account Number 100027636555708, with Facebook User Name 
"John Earnest”; and 

Facebook ID Account Number 100005829157939, with Facebook | 
Username: “John Tocatina,” 

(hereinafter, the “SUBJECT ACCOUNTS”). The search of the data supplied by 
Facebook, Inc., pursuant to this warrant will be conducted as provided in the 
“Procedures for Electronically Stored Information” of the affidavit submitted in 
support of this search warrant and will be limited to: 

a. Communications, data, or attachments relating to the research, 
purchase, or acquisition of firearms, and the research or manufacture of incendiary 
or explosive devices; 


n 
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b. Communications, data, or attachments tending to identify others 
involved in the criminal activity described below; 

c. Communications, data, or attachments third parties with whom John 
Ernest discussed the criminal activities described below; 

d. Communications, data, or attachments relating to John Earnests’ 
motivation and bias for committing the criminal activities described below; 

e. Communications, data, or attachments relating to the research of, visits 
to, or other connections with the Synagogue located on Chabad Way in Poway, 
California, and/or the Dar-ul-Arqam Mosque and Islamic Center (the “mosque”), 
located at 318 West 6th Avenue in Escondido, California; 

f. Communications, data, or attachments relating to the research or 
viewing of news articles and reports about the arson that occurred at the mosque in 
Escondido, California on March 24, 2019, or criminal acts committed by other 
individuals involving criminal activity described below; 

g. Communications, data, or attachments relating to recruiting and 
inspiring individuals to engage in the criminal activity described below; 

h. Communications, data, or attachments relating to the whereabouts of 
John Earnest and any criminal associates or co-conspirators at the of the April 27, 
2019, shooting at the synagogue on Chabad Way in Poway, and the March 24,2019, 
arson of the mosque in Escondido, California; 

i. Communications, data, or attachments that tend to provide context to 
the information described above, such as direct messages sent or received in 
temporal proximity to any relevant communications, or communications, data, or 
attachments tending to identify the user of or person with control over the 

SUBJECT ACCOUNTS. 


in 
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during the time period from January 1, 2017, through April 27, 2019, which tend to 
prove violations of federal law, namely, intentional obstruction, by force or threat of 
force, of persons in the free exercise of religious belief, resulting in death, in 
violation of 18 U.S.C. § 247(a)(2), willfully causing bodily injury to persons through 
the use of a firearm because of the actual or perceived religion of said persons, 
resulting in death, in violation of 18 U.S.C. § 249(a)(1), and damage to religious 
property, in violation of 18 U.S.C. § 247(a)(1). 


IV 
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AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANT 

I, Maria Solomon, being duly sworn, state: 

I. INTRODUCTION 

1. This affidavit is submitted in support of an application for a search 

warrant pursuant to 18 U.S.C. 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A), for 

information associated with the following Facebook accounts: 

FacebookID AccountNumber 100027636555708, with Facebook User Name 
"John Earnest”; and 

FacebookID AccountNumber 100005829157939, withFacebook Username: 
“John Tocatina,” 

(hereinafter the “SUBJECT ACCOUNTS”), used by John Earnest, and stored at 
the premises owned, maintained, controlled, or operated by Facebook, 1601 Willow 
Road, Menlo Park, California 94025, more fully described in Attachment A. 

2. As more fully described herein, there is probable cause to believe that 
within the SUBJECT ACCOUNTS, more fully described in Attachment A, will be 
found evidence of violations of federal law, namely, intentional obstruction, by force 
or threat of force of persons in the free exercise of religious belief, resulting in death, 
in violation of 18 U.S.C. § 247(a)(2), willfully causing bodily injury to persons 
through the use of a firearm because of the actual or perceived religion of said 
persons, resulting in death, in violation of 18 U.S.C. § 249(a)(1), and damage to 
religious property, in violation of 18 U.S.C. § 247(a)(1), as more fully described in 
Attachment B. 

II. EXPERIENCE AND TRAINING 

3. Iam Special Agent with the Federal Bureau of Investigation (“FBI”) 
and have been so employed as such for eight years. I am currently assigned to the 
San Diego FBI Joint Terrorism Task Force (“JTTF”) and have been assigned to this 
position since 2015. Prior to being assigned to the JTTF, I investigated National 


1 
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Security matters including espionage and proliferation. I have received extensive 
training in evidence collection to include post blast investigations and served on the 
FBI’s Evidence Response Team for six years. As part of my duties as a Special 
Agent, I am have been responsible for investigation violations of federal law, 
including violations of material support to terrorism, espionage, weapons 
proliferation and weapons of mass destruction. 

4. My knowledge of the facts alleged in this affidavit arises from my 
training and experience, my personal observations, my participation in the federal 
investigation described herein, my conversations with other law enforcement agents, 
and my review of documents obtained during this investigation. Because this 
affidavit is submitted for the limited purpose of securing a search warrant as 
described herein, it does not include every fact known to me concerning this 
investigation. 

III. FACEBOOK 

5. Facebook owns and operates a free-access social networking website 
of the same name that can be accessed at http://www.facebook.com. Facebook 
allows its users to establish accounts with Facebook, and users can then use their 
accounts to share written news, photographs, videos, and other information with 
other Facebook users, and sometimes with the general public. 

6. Facebook asks users to provide basic contact and personal identifying 
information to Facebook, either during the registration process or thereafter. This 
information may include the user’s full name, birth date, gender, contact e-mail 
addresses, Facebook, passwords, Facebook security questions and answers (for 
passwords retrieval), physical address (including city, state, and zip code), telephone 
numbers, screen names, websites, and other personal identifiers. Facebook also 
assigns a user identification number to each account. 


2 
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7. Facebook users may join one or more groups or networks to connect 
and interact with other users who are members of the same group or network. 
Facebook assigns a group identification number to each group. A Facebook user can 
also connect directly with individual Facebook users by sending each user a “Friend 
request.” If the recipient of a “Friend request” accepts the requests, then the two 
users will become “Friends” for the purposes of Facebook and can exchange 
communications or view information about each other. Each Facebook user’s 
account includes a list of that user’s “Friends” and a “News Feed, “which highlights 
information about the user’s “Friends,” such as status updates, profile changes, 
upcoming events, and birthdays. 

8. Facebook users can select different levels of privacy for the 
communications and information associate with their Facebook accounts. By 
adjusting these privacy settings, a Facebook user can make information available 
only to himself or herself, to particular Facebook users. A Facebook user can also 
create “lists” of Facebook friends to facilitate the application of these privacy 
settings. Facebook accounts also include other account settings that user can adjust 
to control, for example, the types of notifications they receive from Facebook. 

9. Facebook users can create profiles that include photographs, lists of 
personal interests, and other information. Facebook users can also post “status” 
updates about their whereabouts and actions, as well as links to videos, photographs, 
articles, and other items available elsewhere on the Internet. A particular user’s 
profile page also includes a “Wall,” which is a space where the user and his or her 
“Friends” can post messages, attachments, and links that will typically be visible to 
anyone who can view the user’s profile. 

10. Facebook has a Photos application, where users can upload an 
unlimited number of albums and photos. Another feature of the Photos application 
is the ability to “tag” (i.e., label) other Facebook users in a photo or video. For 
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Facebook’s purposes, the photos associated with a user’s account will include all 
photos upload by that user that have not been deleted, as well as all photos uploaded 
by any user that have that user tagged in them. 

11. Facebook users can exchange private messages on Facebook with other 
users. These messages, which are similar to e-mail message, are sent to the 
recipient’s “Inbox” on Facebook, which also stores copies of messages sent by the 
recipient, as well as other information. Facebook users can also post comments on 
the Facebook profiles of other users or on their own profiles; such comments are 
typically associated with a specific posting or item on the profile. In addition, 
Facebook has a Chat feature that allows users to send and receive instant messages 
through Facebook. These chat communications are stored in the chat history for the 
account. Facebook also has a Video Calling feature, and although Facebook does 
not record the calls themselves, it does keep records of the date of each call. 

IV. PROBABLE CAUSE 

12. During the course of my current duties, I have learned the following 
from consulting with other state, local and federal law enforcement officers, 
including San Diego Sheriffs Department (SDSD) Detectives, San Diego County 
District Attorney Investigators, and my fellow FBI agents. 

13. On April 27, 2019 at approximately 11:23 am. San Diego Sheriffs 
Communication Center received a 911 call of shots fired at the Synagogue located 
on Chabad Way in Poway. The reporting party, Dan Sedereff, stated shots were 
fired in the synagogue. 

14. During a briefing by the SDSD following the incident, it was reported 
that a white male, later identified as John Earnest, entered the synagogue through 
the front door and fired several rounds from an AR15 rifle. He then proceeded 
further into the synagogue where he began firing rounds from a handgun. 
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15. The SDSD stated that inside the synagogue was off-duty Border Patrol 
Agent Jonathan Morales who retrieved a revolver weapon from one of the 
congregation members and chased the suspect out of synagogue firing four shots at 
him as he got into a silver Honda that was parked across the street from the church. 
The Honda fled northbound on Rancho Bernardo Road. Morales then returned the 
gun to the congregation members who placed it in a black prayer bag and left it in 
the synagogue. 

16. It was determined by officers that four people were shot and transported 
to the hospital. 

17. SDSD Deputies responded to the synagogue along with paramedics. 
The synagogue was secured by deputies pending obtaining a search warrant from 
state authorities, which was planned to be executed later that day. 

18. The same day (April 27, 2019), at approximately 11:30 a.m., a male 
who identified himself as John Earnest called into California Highway Patrol 
emergency line stating that he had fired shots into the synagogue and was willing to 
surrender to law enforcement. Earnest called from phone number 858.999.1461. 
Earnest gave his location as Phil's BBQ at 17051 West Bernardo Center Dr. He 
stated he was in possession of an AR15 Smith & Wesson MP15 rifle and several 
rounds of ammunition in his vehicle but that he would not use them against law 
enforcement. During that call, Earnest made the following comments, among others: 
“I just shot up a synagogue. I’m defending my country . . . I’m just trying to defend 
my nation against the Jewish people; they’re destroying our people ... I opened fire 
at a synagogue; I think I killed some people.” I am informed and believed that Smith 
& Wesson does not manufacture firearms in the State of California. 

19. San Diego Police Department (“SDPD”) Officers responded to that 
location and took John Earnest into custody without further incident. Seen on the 
front passenger seat was an AR15 rifle but no handgun was visible. Additionally, in 
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the vehicle was a helmet with a Go-Pro camera on it. SDPD Officers were holding 
the vehicle secure at the location pending obtaining and executing a state search 
warrant. 

20. While on scene at the vehicle, it was learned that one of the victims, 
Laurie Kay, died as a result of gunshot wounds. 

21. During a public safety interview with SDPD Detective Rudy Castro, 
John Earnest confirmed his home address as 10134 Freeport Ct., San Diego CA. He 
further stated that there were no further weapons at the home. At that time, Earnest 
did not appear to be under the influence of a controlled substance but did appear to 
have a "fl at affect" as though he was detached or unaffected by his actions. 

22. SDPD SWAT officers and Detectives responded to the residence on 
Freeport Ct. The parents of the suspect were contacted and escorted from the home 
and taken to the Sheriff’s Poway substation, pending the execution of a state search 
warrant on their residence. While at the substation, the parents informed law 
enforcement that their son frequently uses a computer in their home. 

23. Using various search methods, Whitney Buckingham an SDSD system 
data miner, found a manifesto on Pastebin.com written by a person identifying 
himself as John Earnest. In the manifesto, which he named "An Open Letter", 
Earnest made many anti-sematic and anti-muslim statements. One such statement 
which is a direct quote is, "As an individual, I can only kill so many Jews." He states 
he is not a terrorist but that he hates anyone who he sees as a threat to his country. 
Earnest took credit for a fire that had been set at mosque in Escondido a few weeks 
earlier. His exact statement was "I scorched a mosque in Escondido with gasoline a 
week after Brenton Tarrant's sacrifice and they never found shit on me." 
Additionally, he wrote "I spray-painted on the parking lot. I wrote 'For Brenton 
Tarrant -t./pol/." 
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24. I observed part of the post-Miranda statement of Earnest. During that 
interview, he informed an SDSD Detective that he had adopted his ideology of hate 
for members of the Jewish religion approximately 18 month earlier. Based on my 
training and experience, I know that there is a process in which someone undergoes 
adoption of radical ideologies. This process can take several months or several years 
before a person actually commits to those ideologies. During the interview, Earnest 
also stated that he was inspired by individuals such as Adolph Hitler and Brenton 
Tarrant. 

25. Based on information received from Bureau of Alcohol, Tobacco, 
Firearms and Explosives (“ATF”) Special Agent Scott Brahin, on March 24, 2019, 
an unknown individual set fire to a mosque in Escondido, California. 

26. Specifically, on March 24, 2019, at approximately 3:19 a.m., a 911 call 
was placed to report a fire at the Dar-ul-Arqam Mosque and Islamic Center 
(“mosque”), located at 318 West 6th Avenue in Escondido, California. The 
Escondido Fire Department and then Escondido Police Department (“EPD”) 
responded. First responders learned approximately seven individuals had been 
spending the night at the mosque and, at approximately 3:15 a.m., they had observed 
flames and rushed outside to extinguish them with a fire extinguisher. First 
responders noticed ash or charring along approximately half the length of the 
mosque’s west side and spray-painted writing on the asphalt parking lot near where 
the fire had occurred that read, “FOR BRENTON TARRAN r/pol/.” First responders 
also noticed the odor of, or similar to, gasoline at the location of the fire. 

27. Investigators conducted an online search for “Brenton Tarran” and 
noted that he was arrested for the mass shootings at two mosques in New Zealand 
that occurred on March 15, 2019 and is believed to be a white supremacist. 
Investigators also learned “r/pol/” is a reference to an online political discussion 
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board that has been characterized as predominately racist, espousing views 
embraced by white supremacist groups. 

28. Investigators reviewed surveillance footage retrieved from a business 

across the street from the mosque. The camera recorded an individual (“suspect”) 
park his/her four-door sedan in front of the mosque at approximately 3:00 a.m. In 
the video, the suspect exited the vehicle, walked towards the parking lot where the 
message was later found spray painted, and then returned to the vehicle. Shortly 
thereafter, the suspect again exited the car carrying a large container and walked 
toward the area of the mosque where the fire was set. A short time later, at 
approximately 3:15 a.m., a large flash of light and smoke are seen in the video and 
the suspect walked back to the vehicle and drove away westbound on West 6th 
Avenue. In surveillance videos obtained from businesses along the route, 
investigators observed that the suspect appeared to arrive at the mosque on March 
24,2019 by driving eastbound on West 9th Avenue, northbound on South Escondido 
Boulevard, and then westbound on West 6th Avenue, where he parked in front of 
the mosque. Investigators also observed, as noted above, that the suspect left the area 
by driving westbound on West 6th Avenue. Based on their review of surveillance 
videos, investigators believed that the suspect was driving a 2010 to 2015 Civic 
Honda, silver in color. A 

29. Earnest’s statements in the manifesto that he set fire to the Escondido 
mosque on March 24, 2019, is corroborated by the following. At the time of his 
arrest for the synagogue shooting, Earnest was driving a 2012 Honda Civic, grey in 
color. Additionally, the spray painted message left by the mosque arsonist was not 
released to the media. The fact that the manifesto specifically makes reference to 
that message further corroborates that Earnest committed the mosque arson. 

30. On April 27, 2019, Greg Simon of the SDPD located and viewed an 
open source online post regarding the shooting at the synagogue. The post 
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purportedly contains a livestream link referencing the shooting at 
https://www.facebook.com/iohn.eamest.96780 (i.e., Facebook Account Number 
100035547390347, with user name “john.eamest.96780.” 

31. On April 27, 2019, following the synagogue shooting, FBI Special 
Agent Scott Norris submitted a request to Facebook for emergency disclosure of 
records for the “john.eamest.96780” Facebook account, pursuant to 18 U.S.C. 
§ 2702. In response to that request, the Facebook provided records which listed the 
user’s phone as 858.999.1461 (the same number Ernest used to call the CHP on April 
27, 2019). Facebook verified the number on April 7, 2019. Facebook identified two 
additional Facebook accounts possibly utilized by the user of the john.eamest.96780 
Facebook account, which were accessed via the same browser and the same 
electronic device. Those accounts are the SUBJECT ACCOUNTS. The-response 


alsoJndic^ed-that-themser-of-phouemu-mber-<)-lj^^^9AAAlAhhe--same number 
Eme-st-u-sed-te-cal-l-t-' 



Opinions and Conclusions 

32. I know from my training and experience, including consultation with 
other law enforcement agents, in investigations involving Facebook that electronic 
service providers maintain business records that include information listed under the 
Items Subject to Seizure in Attachment B. 

33. Based on my training and experience, including consultation with other 
agents involved in the investigation and prosecution of hate crimes, I know the 
following: 


a. It is common for individuals who commit hate crimes to discuss 
such matters, with co-conspirators via telephone, text messages, emails and social 
media - both before and after such crimes - for the purpose of planning and 
providing updates to one another. 
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b. It is also common that individuals who commit hate crimes to 
discuss their criminal activities with trusted third parties, including friends or loved 
ones, before and after the commission of such crimes, via text messages, emails and 
social media. 

c. It is also common for such individuals who commit hate crimes 
to communicate with other like-minded individuals who support their ideologies, 
beliefs and violent actions, via text messages, emails and social media; 

d. It is common for individuals who commit hate crimes to visit or 
research the planned site of the crimes, prior to committing said crimes, for the 
purposes of planning the successful execution of their criminal activity and their 
getaway, and evidence of such research or prior connection may be in their social 
media sites, including private messaging with third parties; 

e. It is common for individuals who commit hate crimes to post 
statements or send messages to others regarding their bias and motivation for 
committing such crimes, which evidence may be found in their social media sites, 
including private messaging with third parties; 

f. It is common for individuals who commit hate crimes to conduct 
research regarding hate crimes committed by themselves and others, and evidence 
of such research may be found in their social media sites, including private 
messaging with third parties; 

g. It is common for individuals who commit hate crimes to recruit 
others individuals to adopt their ideological beliefs and inspire others to commit 
violent acts in support of those beliefs, and evidence of such recruitment may be 
found in their social media sites, including private messaging with third parties. 

h. It is common for individuals who commit hate crimes to conduct 
research regarding the tools and means to carry out their hate crimes, including 
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research involving obtaining, manufacturing and/or using firearms, dangerous 
weapons, and incendiary and explosive devices. 

34. Based on my training and experience, and my consultation with my 
fellow agents, I also believe that the evidence I seek remains in and will be found in 
the SUBJECT ACCOUNTS despite the passage of time. Routinely, during 
previous cases involving the search of electronically stored data, relevant 
investigative information is found dating back several months or even years. 

V. SEARCH PROTOCOL 

A. Genuine Risk of Destruction of Evidence 

3 5. Based upon my experience and training, and the experience and training 
of other agents with whom I have consulted with, electronically stored data can be 
permanently deleted or modified by users possessing basic computer skills. In this 
case, only if the subject receives advance warning of the execution of this warrant, 
will there be a genuine risk of destruction of evidence. 

B. Prior Attempt to Obtain Evidence 

36. State authorities have obtained a state search warrant for the Facebook 
Account, User Name “john.eamest.96780.” As indicated above, federal agents also 
obtained emergency disclosure of limited records for the “john.eamest.96780” 
Facebook Account which information disclosed the additional SUBJECT 
ACCOUNTS. The United States is unware of any search warrant applications for 
the SUBJECT ACCOUNTS. 

C. Procedures for Electronically Stored Information 

37. Federal agents and investigative support personnel are trained and 
experienced in identifying communications relevant to the crimes under 
investigation. The personnel of Facebook are not. It would be inappropriate and 
impractical for federal agents to search the vast computer network of Facebook for 
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the relevant accounts and then to analyze the contents of those accounts on the 
premises of Facebook. The impact on Facebook’s business would be severe. 

38. Therefore, I request authority to seize all content, including electronic 
mail and attachments, stored instant messages, stored voice messages, photographs 
and any other content from the SUBJECT ACCOUNTS, as described in 
Attachment B. In order to accomplish the objective of the search warrant with a 
minimum of interference with the business activities of Facebook, to protect the 
rights of the subject of the investigation and to effectively pursue this investigation, 
authority is sought to allow Facebook to make a digital copy of the entire contents 
of the accounts subject to seizure. That copy will be provided to me or to any 
authorized federal agent. The copy will be forensically imaged and the image will 
then be analyzed to identify communications and other data subject to seizure 
pursuant to Attachment B. Relevant data will be copied to separate media. The 
original media will be sealed and maintained to establish authenticity, if necessary. 

39. Analyzing the data to be provided by Facebook may require special 
technical skills, equipment and software. It also can be very time-consuming. 
Searching by keywords, for example, often yields many thousands of “hits,” each of 
which must be reviewed in its context by the examiner to determine whether the data 
in within the scope of the warrant. Merely finding a relevant “hit” does not end the 
review process. Certain file formats do not lend themselves to keyword searches and 
keyword search text. Many common electronic mail, database and spreadsheet 
applications, which files may have been attached to electronic mail, do not store data 
as searchable text. The data is saved in a proprietary non-text format. The volume of 
storage allotted by service providers increases, the time it takes to properly analyze 
recovered data increases dramatically. 

40. Based on the foregoing, searching the recovered data for the 
information subject to seizure pursuant to this warrant may require a range of data 
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analysis techniques and may take weeks or even months. Keywords need to be 
modified continuously based upon the results obtained. The personnel conducting 
the examination will complete the analysis within (90) days of receipt of the data 
from the service provider, absent further application to this court. 

41. Based upon my experience and training, and the experience and training 
of other agents with whom I have communicated, it is necessary to review and seize 
all electronic mails that identify any users of the SUBJECT ACCOUNTS and any 
electronic mails sent or received in temporal proximity to incriminating electronic 
mails that provide context to the incrimination mails. 

42. All forensic analysis of the imaged data will employ search protocols 
directed exclusively to the identification and extraction of data within the scope of 
this warrant. 

43. FBI Special Agents have been in contact with Facebook, who is 
expecting FBI to serve them with the warrant as soon as it is signed. For that reason, 
we are requesting permission to serve the warrant on Facebook at any time, day or 
night. 

VI. REQUEST FOR SEALING AND PRECLUSION OF NOTICE 

44. Although John Earnest has been arrested by state authorities, he is 
unaware of the scope and nature of law enforcement’s investigation into his 
activities. Additionally, law enforcement is still investigating whether he acted 
alone, or conspired with others or was inspired by others. As such, there is reason 
to believe that that disclosure of the affidavit and warrant will result in destruction 
of or tampering with evidence or otherwise seriously jeopardize the investigation. 
Accordingly, it is requested that this warrant and its related materials be sealed until 
further order of the Court. In addition, pursuant to Title 18, United States Code, 
Section 2705(b), it is requested that this Court order Facebook to whom this warrant 
is directed not to notify anyone of the existence of this warrant, other than its 
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personnel essential to compliance with the execution of this warrant until October 
25, 2019, absent order from the Court. 

VII. CONCLUSION 

45. Based on the foregoing, your affiant submits that there is probable 
cause to believe that violations of federal criminal law, namely, violations of federal 
law, namely, intentional obstruction, by force or threat of force of persons in the free 
exercise of religious belief, resulting in death, in violation of 18 U.S.C. § 247(a)(2), 
willfully causing bodily injury to persons through the use of a firearm because of the 
actual or perceived religion of said persons, resulting in death, in violation of 18 
U.S.C. § 249(a)(1), and damage to religious property, in violation of 18 U.S.C. § 
247(a)(1), have occurred, and that evidence of said violations, as described in 
Attachment B will be found within the SUBJECT ACCOUNTS. 

I declare under penalty of perjury under the laws of the United States that the 
foregoing is true and correct. 



Maria Solomon 
FBI, Special Agent 


Sworn to before me this 


A^ day of April_2019 
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ATTACHMENT A 

This warrant applies to information associated with following Facebook 
accounts: 

Facebook ID Account Number 100027636555708, with Facebook User Name 
"John Earnest”; and 

Facebook ID Account Number 100005829157939, with Facebook | 
Username: “John Tocatina,” 

that are stored at premises owned, maintained, controlled, or operated by Facebook, 
1601 Willow Road, Menlo Park, California 94025 
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ATTACHMENT B 


I. Service of Warrant 

The officer executing the warrant shall permit Facebook, as custodian of the 
computer files described in Section II below, to locate the files and copy them onto 
removable electronic storage media and deliver the same to the officer. 

II. Items Subject to Seizure 

All registration information; Phone and associated devices; Trusted devices; Deleted 
friends; Last location; IP history; Stored video and audio direct message 
communications; Any and all accounts associated by cookie; User Names and 
profile names; E-mail addresses and passwords; Any and all live stream video 
associated with account; Profile information; Friends information; Private messages 
in the user’s inbox, sent messages, trash/deleted messages, notifications and updates 
involving any and all user; Chat information in the user’s inbox, sent messages, 
trash/deleted messages, notifications and updates involving any and all user; IP logs 
(which includes the date stamps of the IP logs at login), initial login IP address and 
account activity and other information including name, address, phone number and 
other screen names that may tend to identify the user; and any other files associated 
with the following accounts: 

Facebook ID Account Number 100027636555708, with Facebook User Name 
"John Earnest”; and 

Facebook ID Account Number 100005829157939, with Facebook | 
Username: “John Tocatina,” 

(hereinafter, the “SUBJECT ACCOUNTS”). The search of the data supplied by 
Facebook, Inc., pursuant to this warrant will be conducted as provided in the 
“Procedures for Electronically Stored Information” of the affidavit submitted in 
support of this search warrant and will be limited to: 

a. Communications, data, or attachments relating to the research, 
purchase, or acquisition of firearms, and the research or manufacture of incendiary 
or explosive devices; 
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b. Communications, data, or attachments tending to identify others 
involved in the criminal activity described below; 

c. Communications, data, or attachments third parties with whom John 
Ernest discussed the criminal activities described below; 

d. Communications, data, or attachments relating to John Earnests’ 
motivation and bias for committing the criminal activities described below; 

e. Communications, data, or attachments relating to the research of, visits 
to, or other connections with the Synagogue located on Chabad Way in Poway, 
California, and/or the Dar-ul-Arqam Mosque and Islamic Center (the “mosque”), 
located at 318 West 6th Avenue in Escondido, California; 

f. Communications, data, or attachments relating to the research or 
viewing of news articles and reports about the arson that occurred at the mosque in 
Escondido, California on March 24, 2019, or criminal acts committed by other 
individuals involving criminal activity described below; 

g. Communications, data, or attachments relating to recruiting and 
inspiring individuals to engage in the criminal activity described below; 

h. Communications, data, or attachments relating to the whereabouts of 
John Earnest and any criminal associates or co-conspirators at the of the April 27, 
2019, shooting at the synagogue on Chabad Way in Poway, and the March 24,2019, 
arson of the mosque in Escondido, California; 

i. Communications, data, or attachments that tend to provide context to 
the information described above, such as direct messages sent or received in 
temporal proximity to any relevant communications, or communications, data, or 
attachments tending to identify the user of or person with control over the 

SUBJECT ACCOUNTS. 
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during the time period from January 1, 2017, through April 27, 2019, which tend to 
prove violations of federal law, namely, intentional obstruction, by force or threat of 
force, of persons in the free exercise of religious belief, resulting in death, in 
violation of 18 U.S.C. § 247(a)(2), willfully causing bodily injury to persons through 
the use of a firearm because of the actual or perceived religion of said persons, 
resulting in death, in violation of 18 U.S.C. § 249(a)(1), and damage to religious 
property, in violation of 18 U.S.C. § 247(a)(1). 


IV 




